Is Application_AuthenticateRequest always before Session_Start?

Question

Does Application_AuthenticateRequest always fire before Session_Start in global.asax? I'm trying to find some authoritative documentation regarding it.

I assume it does, and researching it suggests it does. But I've not found an authoritative answer (unless I'm missing something).

My normal resource for the asp.net application lifecycle is nicely detailed, but doesn't really go into detail how some of modules' events are ordered.

Does anyone know of some authoritative documentation that details examples of how some of the built in modules events are ordered (particularly the SessionStateModule)?

I've hunted around, but not found anything yet.

Answer 1

I haven't seen any official documentation, but looking at the SessionStateModule in Reflector shows that the Start event is raised by the RaiseOnStart method, which is called from the CompleteAcquireState method, which is called from the BeginAcquireState method, which handles the AcquireRequestState event.

According to the application lifecycle page, the AcquireRequestState event is always raised after the AuthenticateRequest, AuthorizeRequest, ResolveRequestCache and PostMapRequestHandler events.

NB: This is for .NET 4.0, but I believe the same is true for previous versions as well.